Advanced Rule Creation for John the Ripper

Introduction

In this lab, you will delve into the advanced capabilities of John the Ripper's rule engine. John the Ripper is a powerful password cracking tool, and its rule engine allows for highly customized and efficient attacks. Understanding how to craft effective rules is crucial for maximizing its potential. You will learn about rule chaining, creating rules for common transformations like Leet Speak, developing rules for typical password patterns, testing complex rule sets, and optimizing rule performance. By the end of this lab, you will have a solid understanding of how to leverage John the Ripper's rule engine for more sophisticated password cracking scenarios.

Understand Rule Chaining

In this step, you will learn about rule chaining in John the Ripper. Rule chaining allows you to combine multiple rules to create more complex transformations. This is particularly useful when you need to apply a sequence of modifications to a wordlist entry.

First, let's ensure John the Ripper is installed. If not, you can install it using apt.

sudo apt update
sudo apt install -y john

Next, we will create a simple wordlist file named wordlist.txt in your ~/project directory.

echo "password" > ~/project/wordlist.txt
echo "secret" >> ~/project/wordlist.txt

Now, let's create a rule file named chain_rules.rule in ~/project that demonstrates basic rule chaining. This rule will first append "123" to the word and then capitalize the first letter.

nano ~/project/chain_rules.rule

Add the following content to the chain_rules.rule file:

: A123 c

• : (colon) indicates the start of a rule.
• A123 appends "123" to the end of the word.
• c capitalizes the first letter of the word.

Save the file by pressing Ctrl+X, then Y, then Enter.

Now, let's use John the Ripper with this rule file. We'll use the --stdout option to see the transformed words without actually cracking passwords.

john --wordlist=~/project/wordlist.txt --rules=~/project/chain_rules.rule --stdout

You should see output similar to this:

Password123
Secret123

This demonstrates how rules are chained: A123 is applied first, then c is applied to the result.

Create Rules for Leet Speak Transformations

In this step, you will create rules to perform Leet Speak transformations. Leet Speak (or "1337 Speak") is a common practice where letters are replaced by numbers or symbols that resemble them (e.g., 'a' becomes '4', 'e' becomes '3', 's' becomes '5'). This is a frequent technique used in passwords.

We will create a new rule file named leet_rules.rule in your ~/project directory. This file will contain rules to convert common letters to their Leet Speak equivalents.

nano ~/project/leet_rules.rule

Add the following content to the leet_rules.rule file:

: s/a/4 s/e/3 s/i/1 s/o/0 s/s/5

• s/old/new is a substitution rule. It replaces the first occurrence of old with new.
• We are chaining multiple substitution rules to apply several Leet Speak transformations.

Save the file by pressing Ctrl+X, then Y, then Enter.

Now, let's test these rules with our wordlist.txt.

john --wordlist=~/project/wordlist.txt --rules=~/project/leet_rules.rule --stdout

You should see output similar to this:

p4ssw0rd
s3cr3t

This demonstrates how you can create rules to handle common Leet Speak variations, which can significantly improve the effectiveness of your password cracking efforts against users who employ these substitutions.

Develop Rules for Common Password Patterns

In this step, you will develop rules that target common password patterns, such as appending years or common numbers, or capitalizing the first letter. These patterns are frequently used by users to make their passwords "stronger" without truly increasing their entropy.

Let's create a new rule file named pattern_rules.rule in your ~/project directory. This file will combine several common transformations.

nano ~/project/pattern_rules.rule

Add the following content to the pattern_rules.rule file:

: c A2023
: c A!
: c A@

• c capitalizes the first letter.
• A2023 appends the year "2023".
• A! appends an exclamation mark.
• A@ appends an at symbol.

Each line represents a separate rule. John the Ripper will apply each rule to every word in the wordlist independently.

Save the file by pressing Ctrl+X, then Y, then Enter.

Now, let's test these rules with our wordlist.txt.

john --wordlist=~/project/wordlist.txt --rules=~/project/pattern_rules.rule --stdout

You should see output similar to this:

Password2023
Secret2023
Password!
Secret!
Password@
Secret@

This demonstrates how you can create a set of rules to cover common password patterns, significantly expanding your attack surface beyond simple dictionary words.

Test Complex Rule Sets

In this step, you will combine the concepts learned so far to test a more complex rule set. This involves creating a rule file that incorporates both Leet Speak transformations and common pattern additions, demonstrating how multiple rule types can be used together.

Let's create a comprehensive rule file named complex_rules.rule in your ~/project directory. This file will include Leet Speak substitutions and then append common numbers or symbols.

nano ~/project/complex_rules.rule

Add the following content to the complex_rules.rule file:

: s/a/4 s/e/3 s/i/1 s/o/0 s/s/5 A123
: s/a/4 s/e/3 s/i/1 s/o/0 s/s/5 A!

• The first rule applies Leet Speak and then appends "123".
• The second rule applies Leet Speak and then appends "!".

Save the file by pressing Ctrl+X, then Y, then Enter.

Now, let's test these complex rules with our wordlist.txt.

john --wordlist=~/project/wordlist.txt --rules=~/project/complex_rules.rule --stdout

You should see output similar to this:

p4ssw0rd123
s3cr3t123
p4ssw0rd!
s3cr3t!

This demonstrates the power of combining different rule types to generate a wide range of potential password candidates, which is essential for effective password cracking.

Optimize Rule Performance

In this step, you will learn about optimizing rule performance. While complex rules are powerful, they can also be computationally intensive. John the Ripper provides mechanisms to optimize rule application, primarily by understanding the order of operations and avoiding redundant rules.

One way to optimize is to ensure your rules are as specific as possible and avoid generating unnecessary candidates. For instance, if you know a password will always start with a capital letter, applying a rule that capitalizes every letter is inefficient.

Consider the complex_rules.rule from the previous step. Each rule applies all Leet Speak substitutions before appending. If you had many such rules, repeating the substitutions could be less efficient than applying them once and then branching. However, for simple cases, chaining within a single rule is often efficient enough.

For very large rule sets or specific scenarios, John the Ripper allows for more advanced rule syntax and external rule files. For this lab, we will focus on a conceptual understanding of optimization.

A common optimization technique is to filter your wordlist or target specific patterns with separate, smaller rule sets rather than one massive, all-encompassing rule set.

Let's demonstrate a simple optimization concept by creating a rule that only applies if the word is shorter than a certain length, using the l (length) rule. This can prevent applying complex rules to words that are already too long to be common passwords.

Create a new rule file named optimized_rules.rule in your ~/project directory.

nano ~/project/optimized_rules.rule

Add the following content to the optimized_rules.rule file:

: l<10 s/e/3 A!

• l<10 means "only apply this rule if the word length is less than 10 characters".
• s/e/3 substitutes 'e' with '3'.
• A! appends an exclamation mark.

Save the file by pressing Ctrl+X, then Y, then Enter.

Now, let's test this rule with our wordlist.txt.

john --wordlist=~/project/wordlist.txt --rules=~/project/optimized_rules.rule --stdout

You should see output similar to this:

s3cr3t!
p4ssw0rd!

Both "password" (8 chars) and "secret" (6 chars) are less than 10 characters, so the rule applies. If you had a word like "superlongpassword" (17 chars), this rule would not apply to it, thus saving computation.

Understanding how to selectively apply rules based on conditions like length can significantly improve the performance of your cracking attempts by reducing the number of unnecessary candidates generated.

Summary

In this lab, you have gained a comprehensive understanding of advanced rule creation for John the Ripper. You started by exploring rule chaining, which allows for sequential transformations. You then learned how to create specific rules for common Leet Speak transformations and developed rules to target prevalent password patterns. Furthermore, you practiced testing complex rule sets by combining different rule types. Finally, you were introduced to concepts of optimizing rule performance, such as using conditional rules to reduce unnecessary computations. These skills are fundamental for effectively leveraging John the Ripper in real-world password auditing and cracking scenarios.